CVE-2026-77017 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

CVE-2026-77018

The Workeera WordPress plugin (Remote Tech Job Board) before 1.0.6 allows users with a subscriber role to submit unrestricted profile values, which the plugin writes as an unvalidated file into a publicly reachable directory. This mass-assignment flaw enables arbitrary file upload and, consequent...

CVE-2026-77017

CVE-2026-77017 affects the Workeera Remote Tech Job Board WordPress plugin in versions prior to 1.0.6 . The root cause is a mass assignment flaw in the candidate profile feature: the plugin does not restrict which profile values a candidate may submit, nor does it confine the stored file location...

CVE-2026-77016

The Workeera WordPress plugin (Remote Tech Job Board) prior to version 1.0.6 is vulnerable to arbitrary file deletion via mass assignment on the candidate profile. The plugin does not restrict which values a user can write to their own candidate profile, nor does it validate the stored file path ...

CVE-2026-77016 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

CVE-2025-2304-POC

CVE-2025-2304-POC CVE-2025-2304 के लिए मैन्युअल PoC: Camaleon CMS संस्करण 2.9.0 शोषण के चरण 1. एक निम्न-विशेषाधिकार वाले उपयोगकर्ता जैसे, "Bob" के रूप में लॉग इन करें। 2. प्रॉक्सी जैसे Burpsuite, caido और अन्य का उपयोग करके पासवर्ड परिवर्तन को इंटरसेप्ट करें। 3. पासवर्ड परिवर्तन के दौरान...

CVE-2025-2304-POC

CVE-2025-2304 PoC - Escalation dei privilegi in Camaleon CMS Un exploit Proof of Concept PoC per CVE-2025-2304 , una vulnerabilità critica di mass assignment in Camaleon CMS che consente l'escalation dei privilegi da utenti con privilegi bassi ad amministratori. root@kitploit: ██████╗ ██████╗ ██╗...

CVE-2025-2304-POC

CVE-2025-2304-POC PoC para CVE-2025-2304 — escalada de privilegios en Camaleon CMS 2.9.0 mediante asignación masiva en el endpoint de cambio de contraseña. Vulnerabilidad El endpoint /admin/users/:id/updatedajax no filtra el parámetro role antes de pasarlo a la actualización del modelo, lo que...

HTB-Facts-Writeup

HackTheBox — Writeup della macchina Facts Informazioni Macchina Campo| Dettagli ---|--- Nome| Facts SO| Linux Difficoltà| Facile Rilascio| Stagione 10 Ritirata| No Panoramica della Catena di Attacco root@kitploit: Recon → Web Enumeration → CVE-2025-2304 Mass Assignment → S3/MinIO Credential Leak ...

CVE-2025-2304

Camaleon CMS 2.9.0 – Escalação de Privilégio Autenticada Alteração de Função + Vazamento Opcional de Config S3 Alvo: Camaleon CMS v2.9.0 Tipo: Escalação de privilégio autenticada via mass-assignment em updatedajax campo role Extras: Extração opcional da configuração S3 da página de configurações ...

CVE-2025-2304

Camaleon CMS v2.9.1 - Mass Assignment porta a Privilege Escalation - Strumento di Exploit - PoC Descrizione Questo progetto è uno strumento proof of concept di sfruttamento basato su Python che dimostra e analizza una vulnerabilità di escalation dei privilegi che interessa le versioni v2.9.1 di...

laravel-access-control-lab

laravel-access-control-lab A deliberately vulnerable Larave...

CVE-2026-77710

misp-stix (the MISP STIX import library) is vulnerable to STIX2 parser confusion and mass assignment (CWE-915, CWE-807). The import logic selected between the internal MISP parser and the external STIX parser based on untrusted metadata—MISP-specific tool labels (STIX2) or document title (STIX1)—...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Summary The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this-guard-user-update$request-except'token'. Because the controller uses except'token' rather than $request-validated or the restricted keys defined in AccountInfoRequest::validationData, an...

CVE-2026-62315

Frappe (full-stack web application framework) is affected by a type confusion vulnerability in frappe.client.set_value (frappe/client.py) in version 16.31.0 and earlier . The function validates a dictionary supplied via the fieldname parameter against forbidden standard and child-table fields bef...

CVE-2026-62315 Frappe: Mass assignment via set_value

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An...

CVE-2026-62315 Frappe: Mass assignment via set_value

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An...